b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408

Analysis

max time kernel
29s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe
Size

53KB
MD5

058916cc5699aed21402c07a6c9750ef
SHA1

b8798b1a70f873294d3bb51a758f54bfc99349d4
SHA256

b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408
SHA512

bc368d76939384f75c97186f722b8632071e38e6700ab0690d6b43895e63e4b36eaa3ec7c3c70b38f0d8af901d294404306dc163221edf2b449c9e1dfa576a21
SSDEEP

768:uJChTypVTFylNCQKowZS4E6SynTruH712N3b4wFBOV1mJt6oRZPJW2q5Q/2wRO:uAhTyTTFQNC13U4rtnDb4tmJ8AJq48

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe

description	pid	process	target process
PID 788 wrote to memory of 1052	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 1052	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 1052	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 1052	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 1052	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 1052	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 1052	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 360	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 360	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 360	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 360	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 360	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 360	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe
PID 788 wrote to memory of 360	788	b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe
"C:\Users\Admin\AppData\Local\Temp\b386b4b7c4fff1b9356588a17d1db9d0709cee88eba769825bf7e579f8e53408.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\newsetup.vbs"
2⤵
PID:1052

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\1.vbs"
2⤵
PID:360

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\newsetup.vbs
Filesize
651B

MD5
4736e7158c27f244482f5a614b9dbdae

SHA1
d3a0e95a81e9e3ec95cfd596b25749a0e24e27b9

SHA256
b8229bc8d6b0013858fb9599cb510afa4566a439164b2c7444c449540a124acc

SHA512
cebf895dd3ec3822c42b78bac49c685b063cb5afcbcfb3850b073cb118d086c5fa75ec50b6e73d90e14f2c6b595752ad87910b8cf27378424d72a9ea309bf824

Download Submit
memory/360-57-0x0000000000000000-mapping.dmp

Download
memory/788-54-0x0000000074E01000-0x0000000074E03000-memory.dmp

Filesize
8KB

Download
memory/1052-55-0x0000000000000000-mapping.dmp

Download